From owner-freebsd-questions@FreeBSD.ORG Mon Jul 3 03:37:15 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 1E5B716A52D for ; Mon, 3 Jul 2006 03:37:15 +0000 (UTC) (envelope-from on@cs.ait.ac.th) Received: from mail.cs.ait.ac.th (mail.cs.ait.ac.th [192.41.170.16]) by mx1.FreeBSD.org (Postfix) with ESMTP id 83A4E43EEF for ; Mon, 3 Jul 2006 03:10:44 +0000 (GMT) (envelope-from on@cs.ait.ac.th) Received: from banyan.cs.ait.ac.th (banyan.cs.ait.ac.th [192.41.170.5]) by mail.cs.ait.ac.th (8.13.1/8.12.11) with ESMTP id k633AfE2086792 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 3 Jul 2006 10:10:41 +0700 (ICT) Received: (from on@localhost) by banyan.cs.ait.ac.th (8.13.3/8.12.11) id k633Ad6e088860; Mon, 3 Jul 2006 10:10:39 +0700 (ICT) Date: Mon, 3 Jul 2006 10:10:39 +0700 (ICT) Message-Id: <200607030310.k633Ad6e088860@banyan.cs.ait.ac.th> From: Olivier Nicole To: mark@msen.com In-reply-to: <200606302344.57811.mark@msen.com> (message from Mark Moellering on Fri, 30 Jun 2006 23:44:57 -0400) References: <200606302344.57811.mark@msen.com> X-Virus-Scanned: on CSIM by amavisd-milter (http://www.amavis.org/) Cc: freebsd-questions@freebsd.org Subject: Re: DNS discovery / FreeBSD Firewall X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Jul 2006 03:37:15 -0000 > The questions is; How do I have the internal network machines > get the DNS server settings from the Firewall? The two scenarios I > can think of are: that the Firewall also acts as a DHCP server and > somehow set the DNS of the internal net machines to the Firewalls > resolv.conf entries; or I can have the Firewall act as a DNS > server/relay and forward the DNS requests. If your ISP keep changing their DNS server I'd suggest another solution: set your own DNS server, but on a machine different from the firewall. Just make sure that the filrewall let domain traffic (udp/53 and tcp/53) go through. And configure the firewall to use your own DNS server. DNS server needs NO resources, an old PIII 500 will do the trick. It is always a good choice to have the firewall be only a firewall and nothing else. If you add DNS on your firewall and DNS has somore vulnerabilities, your firewall would be comprimised... Bests, Olivier